The nature of malicious code, or malware (e.g., viruses, worms, bots, or the like) have been used to disrupt network service. In the past, malware was designed primarily to propagate. The number of such intrusions and defenses multiplied when malware is designed to infiltrate a large number of machines networked together. A great deal of modern malware makes use of polymorphic techniques. In this regard, the malware frequently changes attack states or uses different file names, hashes, or signatures to encrypt or otherwise hide its code so as to avoid detection and eradication as it propagates through a network. There is a need for enhanced detection of such polymorphic malicious content as it propagates through the network of an entity.